| Message ID | 20240307093733.41222-2-yangxingui@huawei.com |
|---|---|
| State | New |
| Headers | show |
| Series | scsi: libsas: Fix disk not being scanned in after being removed | expand |
Hi Xingui,
kernel test robot noticed the following build warnings:
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Xingui-Yang/scsi-libsas-Allow-smp_execute_task-arguments-to-be-on-the-stack/20240307-174215
base: https://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git for-next
patch link: https://lore.kernel.org/r/20240307093733.41222-2-yangxingui%40huawei.com
patch subject: [PATCH v3 1/3] scsi: libsas: Allow smp_execute_task() arguments to be on the stack
config: i386-randconfig-141-20240308 (https://download.01.org/0day-ci/archive/20240310/202403102353.jUPi6fOP-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
| Closes: https://lore.kernel.org/r/202403102353.jUPi6fOP-lkp@intel.com/
New smatch warnings:
drivers/scsi/libsas/sas_expander.c:148 smp_execute_task() warn: possible memory leak of '_req'
vim +/_req +148 drivers/scsi/libsas/sas_expander.c
adfd2325dfc5cf6 Xingui Yang 2024-03-07 138 static int smp_execute_task(struct domain_device *dev, void *req, int req_size,
adfd2325dfc5cf6 Xingui Yang 2024-03-07 139 void *resp, int resp_size)
adfd2325dfc5cf6 Xingui Yang 2024-03-07 140 {
adfd2325dfc5cf6 Xingui Yang 2024-03-07 141 struct scatterlist req_sg;
adfd2325dfc5cf6 Xingui Yang 2024-03-07 142 struct scatterlist resp_sg;
adfd2325dfc5cf6 Xingui Yang 2024-03-07 143 void *_req = kmemdup(req, req_size, GFP_KERNEL);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 144 void *_resp = alloc_smp_resp(resp_size);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 145 int ret;
adfd2325dfc5cf6 Xingui Yang 2024-03-07 146
adfd2325dfc5cf6 Xingui Yang 2024-03-07 147 if (!_req || !resp)
adfd2325dfc5cf6 Xingui Yang 2024-03-07 @148 return -ENOMEM;
I haven't looked at the callers so I don't know how likely it is for one
of the allocations to fail and the other succeed... But it seems
possible.
adfd2325dfc5cf6 Xingui Yang 2024-03-07 149
adfd2325dfc5cf6 Xingui Yang 2024-03-07 150 sg_init_one(&req_sg, _req, req_size);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 151 sg_init_one(&resp_sg, _resp, resp_size);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 152 ret = smp_execute_task_sg(dev, &req_sg, &resp_sg);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 153 memcpy(resp, _resp, resp_size);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 154 kfree(_req);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 155 kfree(_resp);
adfd2325dfc5cf6 Xingui Yang 2024-03-07 156 return ret;
adfd2325dfc5cf6 Xingui Yang 2024-03-07 157 }
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c index a2204674b680..1eeb69cba8da 100644 --- a/drivers/scsi/libsas/sas_expander.c +++ b/drivers/scsi/libsas/sas_expander.c @@ -120,17 +120,6 @@ static int smp_execute_task_sg(struct domain_device *dev, return res; } -static int smp_execute_task(struct domain_device *dev, void *req, int req_size, - void *resp, int resp_size) -{ - struct scatterlist req_sg; - struct scatterlist resp_sg; - - sg_init_one(&req_sg, req, req_size); - sg_init_one(&resp_sg, resp, resp_size); - return smp_execute_task_sg(dev, &req_sg, &resp_sg); -} - /* ---------- Allocations ---------- */ static inline void *alloc_smp_req(int size) @@ -146,6 +135,27 @@ static inline void *alloc_smp_resp(int size) return kzalloc(size, GFP_KERNEL); } +static int smp_execute_task(struct domain_device *dev, void *req, int req_size, + void *resp, int resp_size) +{ + struct scatterlist req_sg; + struct scatterlist resp_sg; + void *_req = kmemdup(req, req_size, GFP_KERNEL); + void *_resp = alloc_smp_resp(resp_size); + int ret; + + if (!_req || !resp) + return -ENOMEM; + + sg_init_one(&req_sg, _req, req_size); + sg_init_one(&resp_sg, _resp, resp_size); + ret = smp_execute_task_sg(dev, &req_sg, &resp_sg); + memcpy(resp, _resp, resp_size); + kfree(_req); + kfree(_resp); + return ret; +} + static char sas_route_char(struct domain_device *dev, struct ex_phy *phy) { switch (phy->routing_attr) {
We need to use alloc_smp_resp() and alloc_smp_req() before call smp_execute_task() as we can't allocate these memories on the stack for calling sg_init_one(). But if we changed smp_execute_task() to memcpy from/to data on the stack, it might make callers simpler. Suggested-by: John Garry <john.g.garry@oracle.com> Signed-off-by: Xingui Yang <yangxingui@huawei.com> --- drivers/scsi/libsas/sas_expander.c | 32 ++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 11 deletions(-)